Yyds.Auto

This skill appears to be what it says (an Android RPA MCP client) but it grants powerful, sensitive capabilities on devices (root/shell access, IMEI and filesystem reads, app control). Before installing: 1) Verify the npm package publisher and inspect the package source (or install in a controlled environment) — npm packages can execute arbitrary code. 2) Only connect devices you trust and be aware that the skill can read device identifiers and files. 3) Prefer using a non-root device or limit device access if possible; do not connect production devices with sensitive data unless you fully trust the package. 4) When adding to editor/agent configs, avoid using npx -y if you want to prevent implicit network installs; install the package explicitly and pin a specific version. 5) If you need higher assurance, request the package's source repo or a signed release and audit the code before granting device access.